CVE-2026-23516: CVAT vulnerable to XSS via skeleton SVG images
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23516?
CVE-2026-23516 is classified as a high severity vulnerability due to its ability to allow arbitrary JavaScript execution in user sessions.
How do I fix CVE-2026-23516?
To fix CVE-2026-23516, update CVAT to version 2.55.0 or later where the vulnerability has been patched.
What types of attacks does CVE-2026-23516 enable?
CVE-2026-23516 enables Cross-Site Scripting (XSS) attacks where an attacker can execute malicious scripts in the context of a victim user's session.
Which versions of CVAT are affected by CVE-2026-23516?
CVE-2026-23516 affects CVAT versions between 2.2.0 and 2.54.0 inclusive.
Can I still use CVAT if I have version 2.54.0 regarding CVE-2026-23516?
Using CVAT version 2.54.0 is risky due to CVE-2026-23516, and it is recommended to upgrade to a secure version immediately.